{"record":{"id":"7ef01ef398a8ed8a","repo":"apereo/cas","slug":"configuration-element-indicated-an-entitycertifica","errorCode":null,"errorMessage":"Configuration element indicated an entityCertificate, but multiple certificates were decoded","messagePattern":"Configuration element indicated an entityCertificate, but multiple certificates were decoded","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java","lineNumber":124,"sourceCode":"            credential.getKeyNames().addAll(this.keyNames);\n        }\n\n        return credential;\n    }\n\n    @Override\n    public Class<?> getObjectType() {\n        return BasicX509Credential.class;\n    }\n\n    private X509Certificate getEntityCertificate() {\n        if (null == entityResource) {\n            return null;\n        }\n        try {\n            val certs = X509Support.decodeCertificates(entityResource.getInputStream());\n            if (certs.size() > 1) {\n                throw new BeanCreationException(\"Configuration element indicated an entityCertificate,\"\n                    + \" but multiple certificates were decoded\");\n            }\n            return certs.iterator().next();\n        } catch (final Exception e) {\n            throw new BeanCreationException(\"Could not decode provided Entity Certificate file \"\n                + entityResource.getDescription(), e);\n        }\n    }\n\n    private List<X509Certificate> getCertificates() {\n        if (certificateResources == null) {\n            return new ArrayList<>();\n        }\n\n        val certificates = new LazyList<X509Certificate>();\n        for (val r : certificateResources) {\n            try (val is = r.getInputStream()) {\n                certificates.addAll(X509Support.decodeCertificates(is));","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java#L106-L142","documentation":"getEntityCertificate() decodes the resource referenced by entityResource and requires exactly one X509 certificate, because the entityCertificate configuration element models a single certificate. If X509Support.decodeCertificates() yields more than one certificate from that file, the bean creation is aborted with this BeanCreationException. This guards against ambiguous PEM bundles being silently treated as the single entity certificate.","triggerScenarios":"entityResource points to a file containing multiple certificates — typically a full-chain PEM (leaf + intermediates) or a concatenated .pem bundle — passed as the single entityCertificate element, decoded in getEntityCertificate().","commonSituations":"Downloading a cert chain from a CA (fullchain.pem from Let's Encrypt) and wiring it as entityCertificate; concatenating cert + CA cert into one file; exporting from a keystore into a multi-cert PEM; confusion between the single entityCertificate element and the certificates/CertificateFile list element which is meant for chains.","solutions":["Split the PEM file so the entityCertificate resource contains only the single entity (leaf) certificate block.","Move the extra certificates into the certificateResources/CertificateFile element, which accepts multiple certificates for the chain.","Extract just the first/leaf block with a text editor or: openssl x509 -in fullchain.pem -out leaf.pem.","If multiple certs are intentional, use the multi-certificate configuration property instead of entityCertificate."],"exampleFix":"# before: entityCertificate=file:/etc/cas/fullchain.pem  (leaf + intermediates)\n# after\ncas.authn.saml.idp.credential.entity-certificate=file:/etc/cas/idp-leaf.pem\ncas.authn.saml.idp.credential.certificates=file:/etc/cas/intermediate.pem","handlingStrategy":"validation","validationCode":"// pre-check the entity certificate resource yields exactly one cert\ntry (var is = entityResource.getInputStream()) {\n    var certs = X509Support.decodeCertificates(is);\n    if (certs.size() != 1) {\n        throw new IllegalStateException(\"entityCertificate must contain exactly 1 certificate, found \" + certs.size());\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep single-cert files (leaf only) for entityCertificate and put chains in the certificates/CertificateFile element.","Never point entityCertificate at fullchain.pem-style bundles; split them with awk or openssl.","Count BEGIN CERTIFICATE blocks before wiring the file: grep -c 'BEGIN CERTIFICATE' file.pem must return 1."],"tags":["spring","saml","x509","pem","configuration"],"backgroundTag":"invalid-argument-format","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}